Live data from Hacker News

Ask HN: What do you self-host?

news.ycombinator.com

241–250 of 347 posts

Re: Ask HN: What do you self-host?

#241
post #36

I host a bunch of docker containers plus Traefik to route everything. It runs on a cheap GCP instance (more on this here: https://sdan.xyz/sd2 ) Overleaf: https://sdan.xyz/latex A URL Shortener: https://sdan.xyz All my websites ( https://sdan.xyz/drf , https://sdan.xyz/surya , etc.) My blog(s) ( https://sdan.xyz/blog , https://sdan.xyz/essays ) Commento commenting server (I don't like disqus) Monitoring ( https://sda…

I run netdata too, but I keep that behind my VPN. I'd suggest the same for you. No reason to have that exposed to the entire world. I wrote this to setup my web server, mail server and VPN server, and auto-generate all my VPN keys. https://github.com/sumdog/bee2

Any reason to have it behind a VPN?

Re: Ask HN: What do you self-host?

#242
post #91

File server and plex, that’s about it. I have another server I’ll occasionally run a Kubernetes cluster on, otherwise I don’t really bother with self hosting - I hate dev ops shit for a reason...

> I hate dev ops shit for a reason... I notice I was a lot more keen on hosting a bunch of crap myself before I knew how to do it "right", and before devops, orchestration ("you mean running scripts in remote shells?"), cloud, or containers or any of that were things. And yet it all worked just fine back then—time spent fixing problems from my naïve "apt-get install" or "emerge" set-up process wasn't actually that ba…

As a beginner programmer this is something I wonder about. Having worked with many amazing engineers, I have some sense of the effort that goes into "doing it right" and the fear of god put into me for the consequences of not doing it right.

So then look at home projects and I wonder if I know enough to self host things, or host them on GCP in a manner that won't just invite getting hacked, running up a ridiculous bill, or leaking my private sensitive data out.

Any guidance to offer?

Re: Ask HN: What do you self-host?

#243
post #106
post #89

Earlier quoted context omitted.

I've done similar. You firewall your home network to all IP's other than Cloudflare's. You can use a Cloudflare provided certificate for HTTPS - they will MITM and use a trusted cert for outward connections. You can update Cloudflare DNS records via their API - the typical dynamic DNS tools work fine. It works well. I've always been unable to pull this off completely as I always want a way to SSH into my home network…

> I always want a way to SSH into my home network Guacamole (sorta) gives me that. If CloudFlare or nginx or Guacamole have problems then I'm hosed... but I work from home so remote access isn't a huge concern. And I've got nothing terribly "household critical" at home, just the PiHole needs to be running to keep everyone happy. I do wish that PiHole had an HA solution. I've been tempted to set up a pfSense / pfBlock…

> I do wish that PiHole had a HA solution

You could run 2 Pi’s or a Pi and a container in another always on machine for example. Then just point your router‘s primary to the Pi and secondary to the other instance.

Re: Ask HN: What do you self-host?

#245

On my home server (refurbished ThinkPad X201 with a Core i5-520M, 8GB of memory, 1TB internal SSD sync'd nightly to an external 1TB HDD) I run a single-node Kubernetes cluster with the following stuff: * MinIO: for access to my storage over the S3 API, I use it with restic for device backups and to share files with friends and family * CoreDNS: DNS cache with blacklisted domains (like Pihole), gives DNS-over-TLS to t…

nice to see somebody using a thinkpad as a homeserver. I remember comparing low power homeservers, consumer NAS and a refurb Thinkpad and the latter won when considering the price/performance and idle power consumption (<5W). You also get a built screen & keyboard for debugging and a efficient DC-UPS if you're brave enough to leave the batteries in. That's of course assuming you don't need multiple terabytes of stora…

I don't overload the CPU and my storage requirements are low. 95% of my used storage is stuff I wouldn't care if it got lost, but just nice to have around. I only have around 2GB of data I don't want to lose.

I do leave the batteries in. Is it dangerous? I read some time ago that it is not dangerous, but the capacity of the battery drops significantly, I don't care about capacity, and safe shutdowns are important to me.

In the past I used an HP DL380 Gen. 7 (which I still own, and wouldn't mind selling as I don't use it), but I had to find a solution for the noise. And power consumption was at around 18EUR for my EUR/kWh.

Cramming down what ran on 12 cores and 48GiB of RAM on a 2-core, 4GiB (I only upgraded the memory 2 months ago) machine was a real challenge.

The ThinkPad cost me 90EUR (IBM refurbished), we bought two of them, the other one burnt. The recent upgrades (8GiB kit + Samsung Evo 1TB) cost me around 150EUR. Overall a really nice value both in compute per EUR spent and in compute per Wh spent. Really happy with it, I just feel it is not very reliable as it is old.

Re: Ask HN: What do you self-host?

#246
post #228

Earlier quoted context omitted.

There you go! Essentially, this setup achieves 5 features I wanted my DNS to have: - Confidentiality: from my ISP; and from anyone listening to the air for plain-text DNS questions when I'm on public WiFi. Solution: DNS-over-TLS[1] - Integrity: of the answers I get. Solution: DNS-over-TLS authenticates the server - Privacy: from web trackers, ads, etc. Solution: domain name blacklist - Speed: as in, fast resolution t…

I'm using Unbound running on a dd-wrt router for a lot of this same functionality. There are some things I don't do only because they aren't a priority for me. But I certainly got DNS over TLS and DNS blocking going.

Didn't know unbound had DoT.

I learnt about CoreDNS because Kubernetes uses it for service discovery, and once I read about it's "chaining plugins" philosophy I wanted to try it out.

And it was so refreshing coming from Dnsmasq that I fell in love with it.

Re: Ask HN: What do you self-host?

#247

For folks that are reverse proxying I have a few questions... 1) Do you identify the reverse proxy by host or by path? e.g. .yourdomain.com or yourdomain.com/ 2) Do you still run everything over a VPN?

Subdomain as well.

External services I need are directly accessible via a local reverse proxy that's publicly visible over IPv6.

For IPv4-only scenarios I proxy through a linode instance (that also hosts a few things, including my blog) which sends the traffic in over v6.

Obviously this is all fronted by a traditional firewall.

And before you ask: it's surprising how often v6 connectivity is available these days. Mobile phone providers have moved to v6 en masse, and even terrestrial internet providers are starting to get religion.

It's still not available in my workplace (surprise surprise), but other than that, much to my surprise, v6 is my primary mode of connectivity.

Re: Ask HN: What do you self-host?

#248
post #196

“Self-host” is such a weird word. Having your own stuff yourself should be the default , should it not? I mean, you don’t “self-drive” your car, nor “self-work” your job. The corresponding words instead exists for the opposites: You can have a chauffeur and you can outsource your job. I think the problem is entirely caused by the US having absolutely abysmal private internet speeds and capacity. Since you can’t then…

If you take a broader lens, having a private vehicle is an expensive hobby for the rich. And most people actually do outsource their jobs. They are employees rather than working for themselves…

I tend to think of "expensive hobby" as meaning you do it for fun rather than for practical reasons.

While I know that some car owners do just have it for fun, I think a lot more are because it's useful.

Re: Ask HN: What do you self-host?

#249

Earlier quoted context omitted.

> * CoreDNS: DNS cache with blacklisted domains (like Pihole), gives DNS-over-TLS to the home network and to my phone when I'm outside I would be _very_ interested in a write up/explanation of this set up

There you go! Essentially, this setup achieves 5 features I wanted my DNS to have: - Confidentiality: from my ISP; and from anyone listening to the air for plain-text DNS questions when I'm on public WiFi. Solution: DNS-over-TLS[1] - Integrity: of the answers I get. Solution: DNS-over-TLS authenticates the server - Privacy: from web trackers, ads, etc. Solution: domain name blacklist - Speed: as in, fast resolution t…

DoH isn't an "L7 hack to speed up adoption". It's a DNS privacy mechanism that can't easily be disabled by network administrators, unlike DoT. You may have lots of good reasons to want to disable DNS privacy on your own network, and by all means use DoT to do that. But DoH is superior for end-users.

Re: Ask HN: What do you self-host?

#250
post #196

“Self-host” is such a weird word. Having your own stuff yourself should be the default , should it not? I mean, you don’t “self-drive” your car, nor “self-work” your job. The corresponding words instead exists for the opposites: You can have a chauffeur and you can outsource your job. I think the problem is entirely caused by the US having absolutely abysmal private internet speeds and capacity. Since you can’t then…

> I think the problem is entirely caused by the US having absolutely abysmal private internet speeds and capacity. Since you can’t then have your own server at home, you are forced to have it elsewhere with sensible internet connections.

The trend definitely traces to the advent and eventual domination of asymmetric Internet connectivity. My first DSL connection was symmetric, so peer-to-peer networking and running servers ("self-hosting") were just natural. Since then, asymmetric bandwidth has ruled the US.

It's not so much that connectivity technology in the US is strictly poor—many cities have options providing hundreds of megabits or a gigabit or more of aggregate bandwidth. It's that the capacity allocation of some shared delivery platforms (e.g., cable) is dramatically biased toward download/consumption, and against upload/share/host. And there's no way for consumers to opt for a different balance. I'd gladly take 500/500 versus 1000/50. Even business accounts, which for their greatly increased costs are a refuge of symmetric connectivity and static IPs, are more commonly asymmetric today.

I think that this capacity imbalance and bias toward consumption snowballs and reinforces the broader assumptions of consumption at the edge (why make a product you self-host when most people don't have the proper connectivity?). This in turn means more centralization of services, applications, and data.

Nevertheless, even with mediocre upload speeds (measured in mere tens of megabits), I insist on self-hosting data and applications as much as I can muster. All of my devices are on my VPN (using the original notion of "VPN," meaning quite literally a virtual private network; not the more modern use of VPN to mean "encrypted tunnel to an Internet browsing egress node located in a data center"). For example, why would I use Dropbox when I can just access my network file system from anywhere? To me, it's a matter of simplicity. Everything I use understands a simple file system.

Post reply on HN